Administrator access via accepted blank credentials

Weak password requirements in USR-W610 3.1.1.0 and earlier allow remote attackers to gain administrator access with empty credentials. The web management interface accepts and saves blank administrator username and password values, after which its web login and Telnet service authenticate empty credential pairs. The condition requires an administrator to apply blank values first; any attacker able to reach either management service can then obtain full administrative control without credentials.